IN THE CLAIMS: 

The following is a complete listing of claims in this 
application . 

Claims 1-94 (canceled) . 

95. (currently amended) A protection system for a 
computerized device comprising an operating system, and at least 
one peripheral device selected from the group consisting of at 
least one storage device, and at least one communication device, 
the protection system comprising: 

a monitoring and capturing sub-system configured to monitor 
activities relating to said at least one storage device and said 
at least one communication device, and to detect and to act against 
suspicious or dangerous activity; 

an encrypted database in operative connection with said 
operating system, and storing default security rules including 
default rules, pre distribution rules, additionally-acquired 
user-defined rules, and statistics of acceptable program behavior 
continuously learned during system operation, 

said monitoring and capturing sub-system being constructed 
and arranged to receive data from said encrypted database, and to 
block activities of said computerized device in violation of said 
default rules; and 

a user interface operatively connected to said operating 
system, and including means for performing at least one function 
selected from the group consisting of learning acceptable behavior 
patterns to be added to said database, warning the user of 
perceived dangers based on said database and requesting user 
authorization to perform an action^ [[.]] 

wherein accesses access to the encrypted database is tracked 
by the monitoring and capturing sub-system ; and 
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wherein violation of the default security rules by 
unwarranted intrusion results in blocking of the activities of 
said computerized system and protection of the user against the 
unwarranted intrusion . 

96. (previously presented) The system of claim 95, wherein 
the encrypted database further stores a log of security questions 
presented to the user and replies thereto. 

97. (previously presented) The system of claim 95, wherein 
the encrypted database further stores a log of detected suspicious 
activities . 

Claims 98-101 (canceled) 
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